CVE-2026-96606: LB-Link BL-CPE600EU Information Disclosure

CVE-2026-96606 Overview

CVE-2026-96606 is an information disclosure vulnerability affecting the LB-Link BL-CPE600EU router running firmware version 5.8.13. The flaw resides in the Configuration Backup Handler component and is triggered through manipulation of the Mifi_config.bin file. Remote attackers can exploit the weakness without authentication or user interaction, extracting sensitive configuration data from the device. The exploit code has been publicly released, and the vendor did not respond to the disclosure attempt. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve the device configuration backup file, exposing sensitive settings that may facilitate follow-on attacks against the network.

Affected Products

LB-Link BL-CPE600EU firmware version 5.8.13
Configuration Backup Handler component
Devices exposing the Mifi_config.bin retrieval interface to untrusted networks

Discovery Timeline

2026-09-23 - CVE-2026-96606 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96606

Vulnerability Analysis

The vulnerability exists in the Configuration Backup Handler of the LB-Link BL-CPE600EU customer premises equipment. The handler exposes the Mifi_config.bin configuration backup file in a manner that permits unauthorized remote retrieval. Because the endpoint does not enforce authentication or access control checks, any attacker able to reach the device on the network can request and download the backup blob.

Configuration backup files on embedded devices typically contain network settings, service credentials, wireless keys, and administrative parameters. Disclosure of these values undermines the confidentiality of the device and any downstream systems that share credentials or trust relationships.

Root Cause

The root cause is missing authorization on the file retrieval path serving Mifi_config.bin. The Configuration Backup Handler treats the request as a benign file fetch rather than a privileged administrative operation. This design decision maps directly to [CWE-200], where sensitive information is exposed to actors that should not have access.

Attack Vector

Exploitation occurs over the network with low complexity. An attacker issues a direct request to the configuration backup endpoint, retrieves the Mifi_config.bin file, and parses its contents offline. No credentials or user interaction are required. Public exploit code has been released, lowering the barrier for opportunistic scanning and mass exploitation of exposed devices.

No verified proof-of-concept code is included here. See the VulDB entry for CVE-2026-96606 and VulDB Vulnerability #408973 for technical references.

Detection Methods for CVE-2026-96606

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to paths referencing Mifi_config.bin on LB-Link BL-CPE600EU devices
Outbound transfers of binary configuration files from CPE management interfaces to unfamiliar external IP addresses
Web server logs on the device showing successful GET responses for backup resources without a preceding authenticated session

Detection Strategies

Inspect network telemetry for requests targeting the configuration backup endpoint on affected devices
Correlate successful downloads of Mifi_config.bin with the source IP address and session state to identify unauthenticated retrievals
Alert on subsequent reuse of credentials or wireless keys that were stored in the exposed backup file

Monitoring Recommendations

Restrict and log management-interface access to the BL-CPE600EU from trusted administrative networks only
Continuously monitor internet-exposed CPE devices for unexpected file transfers originating from the WAN interface
Feed device logs and network flows into a centralized analytics pipeline to detect scanning patterns that fingerprint LB-Link devices

How to Mitigate CVE-2026-96606

Immediate Actions Required

Remove the BL-CPE600EU management interface from public internet exposure and restrict it to trusted subnets
Rotate any credentials, pre-shared keys, and wireless passphrases stored in the device configuration, assuming they may have been disclosed
Audit device access logs for prior downloads of Mifi_config.bin from untrusted sources

Patch Information

The vendor was contacted about this issue but did not respond, and no patch has been published at the time of NVD entry. Organizations should treat affected devices as unpatched and consider replacement or network isolation until the vendor issues a firmware update. Track updates through the VulDB entry for CVE-2026-96606.

Workarounds

Place the BL-CPE600EU behind a firewall that blocks inbound access to the HTTP/HTTPS management ports from the WAN
Enforce network segmentation so that only administrative hosts can reach the CPE management plane
Disable remote management features on the device if the firmware provides that option, and use out-of-band administration where feasible

bash

# Example firewall rule to block WAN-side access to the device web interface
# Replace <WAN_IF> and <DEVICE_IP> with values matching your environment
iptables -A FORWARD -i <WAN_IF> -d <DEVICE_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -i <WAN_IF> -d <DEVICE_IP> -p tcp --dport 443 -j DROP